Either. What the best approach is depends a bit on your needs / security model. You can e.g. something like storing the session "application user" in a configu

Either. What the best approach is depends a bit on your needs / security model. You can e.g. something like storing the session "application user" in a configuration variable (SET myapp.rls_user =...). But if the user can influence the SQL and that's part of the threat model, you need to do more, because that could be changed by further SQL. Another solution is to just have a session level temp table indicating the current application user.